PT-2017-14967 · Gitlab · Gitlab+1

Publicado 2017-12-17 · Atualizado 2018-01-04 · CVE-2017-17716

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 9.4.0 through 9.4.1

Description The issue is related to the use of the omniauth-ldap library and the gitlab omniauth-ldap gem, where GitLab does not support LDAP SSL certificate verification. This occurred due to unmerged code.

Recommendations For GitLab versions 9.4.0 through 9.4.1, update to version 9.4.2 or later to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-17716

Produtos afetados

Gitlab

Gitlab Omniauth-Ldap

Referências · 8

• https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification · Aviso do Fabricante
• https://gitlab.com/gitlab-org/gitlab-ce/issues/30420 · Aviso do Fabricante
• https://about.gitlab.com/releases/2017/07/28/gitlab-9-dot-4-dot-2-released · Nota
• https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released · Aviso do Fabricante
• https://about.gitlab.com/releases/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification · Nota
• https://osv.dev/vulnerability/CVE-2017-17716 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17716 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-17716 · Nota de Segurança